For purposes of this disclosure, a computational entity capable of receiving and processing requests will be referred to as a server. A computational entity capable of sending requests to a server will be referred to as a client. For example, a client may be a personal computer which sends requests to a server at a stock trading company. The server may be a computer adapted to receive the requests and implement a buy or sell order. In similar fashion, a server may control a large storage system for business records, such as payroll records. A company payroll department may use a client computer to transmit periodic payroll records to the server with a request for writing the records into the storage system.
It is possible for a request previously sent by a genuine client entity to be sent again to the server. This is referred to as a replay attack, because it may cause serious problems. A replay attack may be sent by a malicious client who has snooped on an earlier genuine request from a genuine client. The malicious client may have copied the earlier request and then replayed it at a later time. For example, the request may have been an order to sell a particular stock at a particular price. A genuine client may have sent the original request and it may have been executed once. If a malicious client replays the request a few weeks later when the stock price has changed, or the client's account does not have the required amount of stock to sell, the genuine client can suffer serious financial loss if the sale is again executed.
In similar fashion, a payroll department may have sent a request which causes monthly payroll records to be written into a particular file location. That file may have been updated by the genuine client at a later date. Then, if the original request is resent by a malicious client, the original data may be written into the same file location and the updates may be lost.
A replay attack does not necessarily result from a malicious client who has snooped on genuine requests. It can occur due to human or machine error at the genuine client. In some cases, genuine clients with unreliable networks intentionally retransmit genuine requests. The same type of serious damage can be caused by such accidental, unintentional or even intentional replays of requests.